3:47 AM, and a pager alert for unusual traffic on /api/admin/*. Routes that should have been sealed off behind middleware.ts, returning a clean 401 to anyone without a session cookie. Except the logs showed 200s. Hundreds of them, from IPs that had never touched the app before, all hitting the same handful of admin endpoints within a ten minute window.
That's roughly how a lot of security teams spent a night in early December 2025, when a campaign researchers later named Operation PCPcat started chewing through Next.js deployments. In under 48 hours it compromised more than 59,000 servers, stealing somewhere between 300,000 and 590,000 credential sets out of environment files, SSH keys, and cloud service tokens. A success rate over 64 percent. Each infected box scanning for new targets every 45 minutes, which is the kind of detail that makes you close your laptop and stare at the wall for a minute.
The vulnerability at the center of it, CVE-2025-29927, wasn't exotic. It came down to a single internal header, x-middleware-subrequest, that Next.js used to avoid infinite loops when middleware triggers its own rewrites. The framework trusted that header completely. It never checked whether the header actually came from Next.js itself or from a random curl command on the internet. Send the right value, and the runtime would skip your entire middleware chain, auth checks included, like they were never there.
